xiaoxue_admin
/
dbx
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(ssh): include SHA-1 ETM MAC fallback

This commit is contained in:
t8y2 2026-07-07 14:55:03 +08:00
parent f659a74a87
commit ef39c2bfe8
1 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
crates/dbx-core/src/db/ssh_tunnel.rs
View File

@ -56,9 +56,11 @@ fn ssh_client_config() -> Config {
preferred.kex = Cow::Owned(kex);
let mut mac = preferred.mac.into_owned();
// Keep SHA-1 MAC support as a last-resort fallback for legacy SSH proxies.
if !mac.contains(&mac::HMAC_SHA1) {
mac.push(mac::HMAC_SHA1);
// Keep SHA-1 MAC variants as last-resort fallbacks for legacy SSH proxies.
for algorithm in [mac::HMAC_SHA1_ETM, mac::HMAC_SHA1] {
if !mac.contains(&algorithm) {
mac.push(algorithm);
}
}
preferred.mac = Cow::Owned(mac);
@ -934,10 +936,12 @@ mod tests {
fn ssh_client_config_keeps_legacy_mac_after_safe_defaults() {
let config = ssh_client_config();
let mac = config.preferred.mac;
let sha2_index = mac.iter().position(|algorithm| *algorithm == russh::mac::HMAC_SHA256).unwrap();
let sha2_etm_index = mac.iter().position(|algorithm| *algorithm == russh::mac::HMAC_SHA256_ETM).unwrap();
let sha1_etm_index = mac.iter().position(|algorithm| *algorithm == russh::mac::HMAC_SHA1_ETM).unwrap();
let sha1_index = mac.iter().position(|algorithm| *algorithm == russh::mac::HMAC_SHA1).unwrap();
assert!(sha2_index < sha1_index);
assert!(sha2_etm_index < sha1_etm_index);
assert!(sha1_etm_index < sha1_index);
}
#[test]